Re: CVE-2020-10938/graphicsmagick and additional upstream change

["Chris Lamb" <lamby@debian.org>]

Hi Roberto,

> I am in favor of including both changes, but I am not certain about
> whether it is better to mention both in the changelog and advisories or
> whether it is better to only mention CVE-2020-10938.  I lean slightly
> toward mentioning both CVE-2020-10938 and the thread safety issue, but
> if that is not a good idea I can be easily persuaded.

Potentially "dumb" question here, but would it be a bad idea to
mention the entire background and story, viz the CVE being assigned
after the changes have been committed, etc.?

That would seem to be combine the maximum of clarity to our users with
the minimum of soul-searching & ontological debate regarding what
ought to be included or not by the security team(s).  :)


Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-